Decide whether a data breach has to be notified, and to whom the state rule points
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List the kind of personal information involved, whether it was unencrypted, the states where the affected people live, and whether health information or account numbers are in the set. Do not pick a single national deadline.
- What the lawyer must review
- The FTC's Data Breach Response guide says all states, the District of Columbia, Puerto Rico, and the Virgin Islands have laws requiring notification of security breaches involving personal information, and that other laws may apply depending on the type of information. It does not state one federal consumer deadline. The California Attorney General's page states that California law requires a business to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person, citing California Civil Code section 1798.82(a). A business that must notify more than 500 California residents as a result of a single breach must electronically submit one sample copy of the notice, excluding personally identifiable information, to the Attorney General.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.